McAfee spies malware in legit JavaScript apps
Print storyMore anti-virus false alarm madness
Posted in Enterprise Security, 4th January 2008 16:56 GMT
Free Download - Security Web 2.0
A dodgy anti-virus update from McAfee on Wednesday wrongly identified legitimate JavaScript files as a virus in the second such screw-up by a major security vendor in less than a week.
As a result of the snafu McAfee users who applied the update were falsely warned that their systems were infected by the Exploit-BO JavaScript virus after visiting sites including ESPN and Friendster, the SANS Institute's Internet Storm Centre warns.
The dodgy update is DAT 5197 released on January 2. McAfee pulled the update and issued a replacement signature update (DAT 5198) shortly afterwards.
Faulty anti-virus signature updates are not uncommon across the industry. Spookily rival vendor CA experienced exactly the same type of problem, again involving legitimate JavaScript files been falsely identified as viruses only on Monday. This suggests a general difficulty in tuning heuristic (generic) detection of anti-signature tools to recognise the difference between legitimate JavaScript apps and malware. ®
An Improved Architecture for High-Efficiency, High-Density Data Centers [WP126]
Implementing Energy Efficient Data Centers [WP114]
LDAP Injection
Securing your Online Data Transfer with SSL
The Register Guide to Extended Validation
Inmate hacked prison network, broke into employee database
Miscreants hijacking machines via (freshly patched) Adobe flaw
Martial law planned for Craigslist's red-light district
Cocaine addicted IT manager hacks ex-employer's mail servers